Supermicro BMC IPMI firmware: Privilege escalation via RAKP+ messages
Summary
A logic flaw in the RAKP+ handling of the IPMI implementation in Supermicro BMC firmware allows an attacker to escalate an existing IPMI account to administrator privileges. The CNA lists MBD-X12SPI at version 01.07.20 as affected, and the vendor advisory covers further motherboard SKUs. An attacker needs network access to the BMC and a valid low-privileged account; the CVSS score assumes full loss of confidentiality, integrity and availability on the BMC.
Affected
- MBD-X12SPI, BMC firmware 01.07.20 (per CNA data; default: affected)
- Further Supermicro motherboard SKUs are listed in the vendor advisory, which should be checked for the complete list.
Fixed in
Unknown. Fixed BMC firmware versions per board are listed in the Supermicro advisory.
Workaround
- No vendor-documented workaround known.
- Restrict network access to the BMC management interface until a BMC update is applied.
Exploitation
- In the wild: Unknown. Not listed in CISA KEV as actively exploited.
- Public exploit: None known as of late October 2026 (VulDB reports no exploit available).
- VulDB rates exploitation as easy, which is a heuristic and not observed activity.
Our recommendation
- Update the BMC firmware on all affected Supermicro boards as soon as the vendor's fixed version is confirmed.
- Make sure no BMC or IPMI port is reachable from the internet.
- Review IPMI user accounts and remove unused or shared accounts.
- Check whether the optional SMCRAKP mode is enabled.
- Prioritise CVE-2026-18450 (Critical) from the same advisory alongside this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Supermicro security advisory (BMC IPMI, October 2026) www.supermicro.com
- VulDB CVE-2026-65220 vuldb.com
- VulDB vulnerability 427066 vuldb.com
- Rescana analysis of Supermicro BMC IPMI firmware www.rescana.com
- TheHackerWire CVE-2026-65220 www.thehackerwire.com
- runZero blog: Lights out exposed www.runzero.com
- runZero advisory SMCRAKP key (CVE-2026-18449) www.runzero.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:15.
Original description (NVD)
A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.